CyberRota Analysis
AI-GeneratedThe Russh SSH client and server library prior to version 0.62.6 is vulnerable due to improper handling of authentication attempts, allowing unauthenticated remote clients to exceed the configured maximum number of authentication requests. This flaw can lead to increased risk of brute-force attacks and elevated backend authentication workload, potentially compromising system security. Organizations utilizing this library should prioritize upgrading to version 0.62.6 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.